Rely on Microsoft to filter your email? These days, Microsoft misses the mail mark.
M365 blocks legitimate email
Recently a client contacted me about an obvious phish email that Microsoft and M365 let through. No, it wasn’t one of those pesky calendar phishes that Microsoft lets through. This was an obvious phish, insanely long bizarre email address plus the common listen to this voice message.
I performed a message trace for this user as part of reporting this obvious spam to Microsoft. The message trace for the last 24 hours revealed that Microsoft let the obvious phish message in and blocked a ton of legitimate emails from legitimate organizations.
Microsoft declares the Board of Trade a confidence phish
Yes, M365 has been blocking Board of Trade emails with their verdict that those emails are a regular confidence phish. I’m not the greatest fan of the Vancouver Board of Trade but this seems harsh. See image above.
Microsoft also blocked the South China Morning Post, the Broadbent Institute, Greenport and an email legitimately from Forbes (Forbes verdict not shown in image above).
What is this Override verdicts column? The Microsoft decided to block these senders for the reasons listed and I have had to override their verdict so the client can receive these legitimate emails.
Cost of spam getting in
One or two mistakes every now and then doesn’t cost a lot of fix. But employees having to delete tons of obvious calendar and regular spam starts to add up. Say you pay your employee $25 an hour and every week that employee spends an hour cleaning up calendar spam and reporting phishes to IT and then add the cost of your IT consultant. Then there’s the cost of someone clicking on something that got through.
Microsoft Response
The response of Microsoft support is that you should buy more of their products to fix their obvious mistakes. Do you want to reward Microsoft for screwing up by sending them more money? No. Proper spam filtering should be part of the Exchange email basic purchase.
Microsoft still hasn’t fixed their mobile app to show the real email address instead of the display name. More on that from last year’s blog on Microsoft can’t see the phishing forest for the trees. Microsoft should make their product so the end user can easily determine who really sent the email.
Filter Options
There are other spam filtering products out there but they cost. Normally these are priced per mailbox per month. They will block the calendar spam, the emails that show they are from the Microsoft domain (saw one yesterday showing from support@adminstration.microsoft.com) but are really phishes.
Most of these companies use a better set of filters. You will need your IT consultant to set this up (one time setup) and tweak it occasionally.
Given Microsoft has abandoned proper filtering it’s time to work with your IT consultant to find a third party filter that works for your business.
